EVERY AGENT MUST BE COUNTED. Why Agent Inventory Is Becoming a Governance Primitive

Martin Novak
Synthocracy Institute
Research status: 4 September 2026

Evidence Boundary

This article distinguishes documented developments from analytical synthesis. [A] Empirical claims refer to current legislation and legislative proposals, NIST guidance, enterprise identity architectures, national standards, market developments, and published research available by 4 September 2026. [B] Analytical claims develop the Synthocracy Institute’s interpretation of those developments.

The article does not claim that AI agents are legally equivalent to employees, citizens, or other human institutional members. Nor does the phrase agent population imply personhood. It describes an operational fact: organisations may increasingly contain large numbers of software actors capable of receiving identities, holding permissions, invoking tools, delegating tasks, accessing resources, and producing consequential state changes. The governance question is therefore not whether these systems are “people,” but whether institutions can identify the non-human actors to which they have granted operational power.

The central proposition is:

An institution cannot govern an agent population it cannot enumerate.

Enumeration alone is not sufficient for governance. A registry does not establish that an agent is safe, authorised, aligned, monitored, or legitimate. But without reliable discovery and inventory, almost every stronger governance mechanism becomes harder to implement: ownership, authorization, delegation control, monitoring, revocation, incident response, authority provenance, and accountability all require knowing which operational actors exist in the first place.

The first question may no longer be “What can the agent do?”

Imagine a large enterprise five years from now.

It has 20,000 human employees.

Thousands of conventional service accounts.

Agents embedded in Microsoft, Salesforce, SAP, ServiceNow, security tooling, procurement, finance, customer service, coding environments, logistics, analytics, and internal workflow systems.

Employees create additional agents through low-code tools.

Departments buy specialised agents from vendors.

Coding systems generate temporary sub-agents.

Orchestrators delegate tasks to other agents.

Some agents exist for months.

Some exist for minutes.

Some appear only for one transaction.

Some act on behalf of a named employee.

Others operate under an organisational identity.

Some have direct access to production systems.

Others can create agents that do.

At that point, a surprisingly difficult question appears:

Who—or what—exists inside the institution?

This sounds like cybersecurity asset management.

It is more than that.

A human organisation has always depended on a census of actors. It keeps employment records. It knows which legal entities it owns. It maintains lists of contractors, bank accounts, servers, applications, administrators, credentials, and regulated assets. Roles can be assigned because actors can be identified. Authority can be revoked because the institution knows who holds it. Investigations can begin because investigators know which entities may have participated.

Agentic AI introduces an actor class that can proliferate much faster than the organisational structures designed to govern it.

The result is not merely software sprawl.

It is potentially authority sprawl.

1. Washington has now made agent inventory a legislative question

On 3 September 2026, U.S. Representatives Josh Gottheimer and Mike Lawler introduced the Stop Rogue AI Act, a bipartisan proposal directing NIST to develop standards, guidelines, and best practices for secure AI-agent deployment. Among the proposed areas are continuous verification of agent actions, security and reliability evaluation, tamper-resistant activity logs and a continuous, machine-readable inventory of all AI agents operating in an organisation. If enacted, NIST would have one year to develop the standards; the resulting framework would be voluntary for most organisations but would have particular relevance for federal agencies and contractors. (lawler.house.gov)

The proposal is not law, and its wording may change substantially through the legislative process.

But the inclusion of a machine-readable agent inventory is itself an important signal.

It recognises a problem that precedes almost every sophisticated discussion of agent safety:

an organisation may not know how many agents are operating inside its environment.

Without that knowledge, asking whether those agents are properly secured is already difficult.

Asking who owns them, who authorised them, which ones can delegate, which ones are obsolete, or which ones can move money becomes harder still.

The inventory therefore deserves to be understood not merely as another cybersecurity checklist item.

It is emerging as a governance primitive.

2. Identity infrastructure is already moving in the same direction

NIST’s work on agent identity reached a similar conclusion from the cybersecurity side months earlier.

Its February 2026 concept paper on software and AI-agent identity begins from the observation that agents increasingly receive access to diverse data, tools, and applications and therefore require appropriate mechanisms for identification and authorization. (NIST)

NIST’s August guidance is more explicit. It argues that agents should be treated as first-class entities with their own unique identifiers, credentials, and associated entitlements, rather than borrowing human credentials or hiding behind shared accounts. NIST warns that local deployments and credential sharing can make it difficult to maintain a centrally managed agent-identity repository and undermine accountability and non-repudiation. (NIST)

This is a foundational shift.

Traditional enterprise identity systems could often approximate the organisation through three broad categories:

humans; applications; workloads.

Agentic systems complicate all three.

An agent may resemble a workload technically while acting on behalf of a human.

It may persist like an application while dynamically changing its tasks.

It may receive delegated authority from another agent.

It may create temporary descendants.

It may disappear after a single workflow while its external actions persist.

Identity therefore becomes not merely a login problem but a way to answer:

what is acting?

on whose behalf?

under what authority?

for how long?

Inventory is the first layer on which those answers depend.

3. Microsoft is turning the agent registry into enterprise infrastructure

Microsoft has already moved beyond treating agent identity as a conceptual future problem.

Microsoft Entra Agent ID provides purpose-built identity constructs for AI agents and supports management, lifecycle governance, sponsorship, authorization, conditional access, risk signals, discovery, and activity logging. Microsoft says agent identities should be discoverable and queryable through central administrative systems to prevent agent sprawl and shadow AI. (Microsoft Learn)

The architecture contains an especially revealing feature: each governed agent identity can have an accountable human sponsor responsible for its purpose, lifecycle, and access decisions. If the sponsor leaves the organisation, Microsoft’s governance tooling can transfer sponsorship rather than leaving the agent without a responsible owner. (Microsoft Learn)

Microsoft also distinguishes between agent identity blueprints and individual agent identities. A blueprint can govern an entire family of agents, while individual instances receive their own identity. This enables administrators to disable one agent, an entire blueprint-derived class, or—in extreme cases—agent authentication across a tenant. (Microsoft Learn)

This architecture reveals why an agent inventory cannot simply be a spreadsheet listing chatbot names.

The relevant estate may contain:

a logical agent type;

a blueprint;

multiple persistent identities;

temporary instances;

on-behalf-of agents;

autonomous agents;

agent user accounts;

delegated descendants;

and external agents interacting across organisational boundaries.

The inventory problem is already becoming hierarchical.

4. The market is beginning to build businesses around the census

The startup market is moving in the same direction.

NewCore emerged from stealth in June 2026 with $66 million in funding and an identity architecture designed explicitly for a blended workforce of humans, machines, and AI agents. The company says agents should be first-class identities with their own lifecycle, attribution, trust state, and revocation path. Its platform continuously discovers and maps human and agentic identities, including shadow accounts, orphaned credentials, and ungoverned agents. (newcore.com)

NewCore’s commercial framing is notable:

“You cannot secure what you cannot see.”

More important for Synthocracy is the governance implication behind it.

Its platform distinguishes human on-behalf-of agents, delegated agents, and autonomous workloads and attempts to trace where their authority originates. It also provides a registry through which humans, applications, MCP servers, and agents can be brought into a governed identity environment. (newcore.com)

This is still an early market. Vendor claims should not be confused with independently established performance.

But markets are often useful indicators of where institutional pain is becoming concrete enough for customers to spend money.

Agent identity discovery is no longer only a theoretical standards problem.

It is becoming an enterprise product category.

5. Agent sprawl may be much faster than software sprawl

The scale problem is what makes this different from conventional application inventory.

A company might acquire dozens of important enterprise applications over several years.

Agents can potentially be created in seconds.

A user can build one through a low-code interface.

A coding agent can instantiate another.

An orchestration layer can produce temporary workers for parallel tasks.

A vendor application can add built-in agents through an update.

An agent can appear, perform one task, and disappear before a quarterly governance review occurs.

Gartner now predicts that by 2028 an average global Fortune 500 enterprise could have more than 150,000 agents in use, compared with fewer than 15 in 2025. That is a forecast, not an observed future fact, and it should be treated accordingly. But Gartner’s proposed response is revealing: centralised agent inventory, identity and lifecycle management, monitoring, and explicit retirement of redundant agents. (Gartner)

IBM reports a similar direction from its enterprise research, estimating that most large enterprises will operate digital workforces exceeding 1,600 agents by the end of 2026. (IBM)

BeyondTrust has reported discovering what it describes as a rapidly growing shadow AI workforce, including organisations with more than 1,000 agents, some unknown to their security teams. Because these figures derive from one vendor’s customer telemetry, they should not be generalised to all enterprises. They are nevertheless evidence that undeclared agent populations are no longer purely hypothetical. (BeyondTrust)

The precise forecasts may prove wrong.

The structural problem remains.

The rate at which institutions can create machine actors may exceed the rate at which institutions can discover, classify, assign ownership to, review, and retire them.

That is agent sprawl.

But its deeper consequence is governance lag.

6. The denominator problem: what exactly counts as one agent?

The phrase every agent must be counted contains an immediate difficulty.

What is an agent?

Suppose one orchestration system creates twenty temporary workers to analyse twenty documents and destroys them five minutes later.

Do we have one agent?

Twenty-one agents?

One blueprint and twenty instances?

Twenty execution identities?

One agentic workflow?

Suppose the workers all use the same service account.

Operationally, there are twenty actors.

From the identity system’s perspective, there may appear to be one.

Suppose an agent executes tasks through five external agents offered by different vendors.

Are the external actors members of the organisation’s agent population?

Not institutionally.

But they may be part of its authority surface.

This is why a meaningful inventory needs more than a number.

It needs a counting model.

The most useful abstraction is probably not “how many AI agents do we own?” but several related questions:

How many logical agent types exist?

How many governed agent identities exist?

How many instances are currently active?

How many agents can act on our behalf?

How many external agents can affect our systems?

How many descendants can currently inherit delegated authority?

A board may therefore hear:

“We have 4,000 agents.”

That number could be almost meaningless without knowing what was counted.

The agent census must preserve the denominator.

7. A registered agent is not necessarily an authorised agent

Inventory also needs to distinguish states that conventional discussions often collapse.

The following labels are not proposed as a rigid new ontology. They are plain-language distinctions useful for institutional analysis.

Working category	Meaning
Known agent	The organisation has evidence that the agent exists.
Registered agent	The agent has an entry in an approved registry or identity system.
Authorised agent	The organisation has granted it a legitimate mandate or operational scope.
Active agent	The agent is currently capable of operating or holds usable access.
Delegated agent	It acts under authority received from another human or machine principal.
Orphaned agent	It remains operational or credentialed while its responsible owner, sponsor, purpose, or authority basis is no longer valid or identifiable.
Shadow agent	It operates inside or against organisational resources without the required registration, approval, or governance visibility.

These categories reveal why a raw inventory count is insufficient.

A company could have excellent registration coverage and still possess hundreds of orphaned agents.

It could know an agent exists while having no evidence that its current permissions remain authorised.

It could retire an agent from the registry while leaving valid credentials alive.

It could count a parent agent while failing to count ephemeral delegated descendants.

It could inventory internal agents while ignoring external agents authorised to transact with them.

Governance therefore requires not only population discovery, but population state.

8. The most dangerous agent may be the one everybody forgot

Human organisations have extensive lifecycle processes because identity without lifecycle creates persistent authority.

An employee joins.

Receives a role.

Gains access.

Changes jobs.

Takes leave.

Leaves the organisation.

Accounts are disabled.

Privileges are removed.

Physical access is revoked.

Responsibility transfers.

Agents require an analogous discipline, but at machine speed.

An agent may be created for a three-week project.

Its human sponsor leaves.

The project ends.

The database remains accessible.

The API token remains valid.

The agent continues running a scheduled task.

Nobody notices because the output still looks normal.

The resulting system is not necessarily malicious.

It is ownerless authority.

Microsoft’s decision to require or strongly associate human sponsors with governed agent identities is therefore more consequential than it first appears. Its lifecycle tooling is designed specifically to avoid situations in which agent identities outlive accountable ownership. (Microsoft Learn)

NewCore similarly markets discovery of agentic identities with no verified owner and provides mechanisms to assign ownership or revoke access. (newcore.com)

The governance principle is straightforward:

No consequential agent should outlive the authority structure that justifies its existence.

The institution therefore needs to know not only that an agent exists.

It needs to know why it still exists.

9. Ephemeral agents create a different governance problem

Persistent agents are comparatively easy.

They have names.

Owners.

Long-lived identities.

Stable functions.

Ephemeral agents may be more difficult.

A parent agent can spawn several specialised sub-agents for one task. Those agents may operate for seconds or minutes, inherit a portion of the parent’s context, receive short-lived credentials, and disappear after execution.

This ephemerality is not necessarily a weakness.

In security terms, short-lived identities and credentials can be preferable to permanent, overprivileged accounts. NIST explicitly recommends more dynamic, tightly scoped, short-lived credentials for agentic systems. (NIST)

But ephemeral does not mean unaccountable.

A five-minute agent can still:

send money;

modify production code;

access private information;

create another agent;

contact an external party;

change an administrative state.

The governance requirement should therefore not be:

every temporary agent must become a permanent organisational record with full bureaucratic overhead.

It should be:

every consequential ephemeral agent must be attributable to a governed lineage and recoverable through evidence proportionate to what it was allowed to do.

This points toward a hierarchical inventory:

BLUEPRINT → PARENT IDENTITY → INSTANCE → DELEGATED SUB-AGENT → ACTION.

The individual worker can disappear.

Its place in the authority chain should not.

10. Counting agents is really about counting authority-bearing actors

This is where the problem leaves cybersecurity and enters Synthocracy.

Consider two agents.

Agent One produces internal meeting summaries.

Agent Two can approve supplier payments up to €500,000.

From a population perspective:

two agents.

From a governance perspective:

not remotely equivalent.

An inventory designed only around presence risks treating them as identical objects.

A useful agent census should therefore connect identity to at least the broad contours of authority:

what resources can the agent access;

whether it can write or only read;

whether it can act externally;

whether it can spend;

whether it can make consequential classifications;

whether it can delegate;

whether it can create new agents;

whether actions are reversible;

who can stop it.

The relevant number is not merely:

How many agents exist?

It is also:

How much institutional power is distributed across the population, and where is it concentrated?

This transforms inventory into an authority map.

A company may discover that 90% of its agents are low-consequence assistants while twelve obscure agents hold the permissions capable of materially changing financial, legal, operational, or security states.

Those twelve may matter more than the other 50,000 combined.

Population governance therefore needs both census and power distribution.

11. One agent may hide behind another identity

NIST highlights a particularly dangerous visibility problem: agents are often given the credentials of their human users. This causes the system to record the human as the actor, allowing the agent effectively to impersonate the person. (NIST)

The result is an inventory paradox.

The agent exists operationally.

It does not exist institutionally.

A log says:

Maria accessed the CRM.

In reality:

Agent X acting through Maria’s credential accessed the CRM.

The organisation may therefore undercount its agent population not because the agents are technically invisible, but because they appear inside the identity system as something else.

Microsoft explicitly designed its dedicated agent identities partly to distinguish AI activity from workforce and application identities. (Microsoft Learn)

This distinction is foundational for accountability.

If agent actions inherit the identity of a human, then subsequent investigation can falsely imply that the human directly performed the action.

The visibility problem becomes an authority-provenance problem.

The previous article in this series asked whether we can prove who really decided.

That question cannot be answered reliably if the institution cannot even distinguish which actor really acted.

12. Shadow agents are the new shadow IT—but more consequential

Organisations have lived with Shadow IT for decades.

Employees installed software.

Subscribed to SaaS products.

Created spreadsheets that became mission-critical systems.

Used cloud storage outside approved channels.

AI agents extend the pattern.

But there is an important difference.

Traditional shadow software was often passive until a human used it.

A shadow agent can itself become an operational actor.

It can authenticate.

Retrieve data.

Invoke APIs.

Communicate externally.

Run on schedules.

Generate descendants.

Act when the employee is absent.

Okta defines agent sprawl as uncontrolled proliferation of AI agents without centralised tracking, inventory, or governance, often because business units independently deploy them outside central IT visibility. (okta.com)

AWS describes related enterprise effects: duplicated agents, conflicting actions on shared systems, credential proliferation, hidden costs, silent data corruption, and regulatory boundaries crossed without central awareness. (Amazon Web Services, Inc.)

The critical distinction is therefore:

Shadow IT created unknown software.

Shadow agents can create unknown actors with authority.

That moves the problem closer to institutional governance.

13. Agent creation itself becomes an authority

Suppose a human is authorised to create agents.

Can the created agent create another?

Can that agent create ten?

Can those ten create one hundred?

What authority do descendants inherit?

Can an administrator revoke the family?

Does the organisation know the family exists?

This reveals a new form of institutional power:

agent-creation authority.

It is analogous to the difference between being authorised to perform work and being authorised to appoint others to perform it.

The Microsoft blueprint architecture already begins to reflect this hierarchy by separating templates from instances and enabling controls to propagate across classes of agent identities. (Microsoft Learn)

The Chinese standards architecture is also notable here. China’s 2026 GB/Z 185 series establishes national technical guidance for agent interconnection, including identity codes, identity management, agent descriptions, discovery, interaction, and tool invocation. (english.samr.gov.cn) The identity-code and identity-management components are now formally published as GB/Z 185.2-2026 and GB/Z 185.3-2026. (Openstd)

The U.S. and Chinese approaches differ institutionally, but both are moving toward the same prerequisite:

agents must become identifiable participants in a larger system.

This convergence is significant.

Interoperability requires knowing whom another agent is communicating with.

Security requires knowing what identity is acting.

Governance requires knowing why it is allowed to act.

14. Discovery will have to cross vendor boundaries

Enterprise inventory is difficult because the agent population will not live in one system.

A company may use:

Microsoft agents;

Google agents;

Salesforce agents;

SAP agents;

custom agents;

third-party SaaS agents;

coding agents;

external A2A agents;

MCP-connected services;

vendor-operated agents acting on the organisation’s behalf.

No single identity provider may see the whole estate.

Microsoft is attempting to broaden its registry and Agent ID architecture across Microsoft and non-Microsoft agents, including third-party environments. (Microsoft Learn) NewCore’s commercial proposition similarly emphasises discovering identities beyond a single identity provider. (newcore.com) SAP describes agent governance as an emerging enterprise platform category linking agents, models, and MCP servers to wider business architecture. (SAP News Center)

This suggests that the future agent census cannot be vendor-local.

An organisation will need some way to reconcile:

identity registries;

cloud inventories;

SaaS platforms;

workflow orchestration;

MCP infrastructure;

agent-to-agent protocols;

local machines;

development environments;

runtime telemetry;

business ownership records.

The resulting problem resembles enterprise asset management, IAM, CMDB, software supply-chain management, and organisational governance at once.

No single existing discipline fully owns it.

That is precisely why it is becoming a new governance layer.

15. Inventory without ownership is only observation

Suppose an enterprise succeeds.

It discovers 72,416 agents.

That number will impress a board for approximately five minutes.

Then the real questions begin.

Who owns Agent 48,322?

What does it do?

Who authorised it?

Who pays for it?

Which business process depends on it?

Which systems can it reach?

Which data can it see?

Which model does it use?

Can it delegate?

When was it last active?

When should it expire?

Who receives an alert if it behaves abnormally?

Who can stop it?

Who is accountable if it causes a consequential event?

An inventory without ownership turns invisible agents into visible ambiguity.

That is progress.

It is not governance.

Microsoft’s sponsor concept is therefore instructive. The sponsor is intended to preserve human business accountability even when the agent operates autonomously. (Microsoft Learn)

The deeper Synthocracy principle is:

Every consequential non-human actor should terminate in an identifiable human or institutional authority relationship.

That need not mean a human approves every action.

It means the organisation can answer:

whose authority made this agent possible?

16. Inventory should show relationships, not only rows

Agent populations are networks.

Agent A delegates to B.

B uses MCP Server C.

C exposes Tool D.

A is sponsored by Employee E.

E works in Business Unit F.

Agent A accesses Database G.

Agent B transacts with external Agent H.

Traditional inventories tend to flatten assets into rows:

asset_id

owner

status

Agent governance requires a graph.

NewCore explicitly describes its identity architecture as a live graph connecting human and agentic identities, accounts, access paths, and authority relationships. (newcore.com) Microsoft similarly uses parent-child relationships between blueprints and agent identities and supports sponsor and ownership relationships. (Microsoft Learn)

This points toward a more useful representation:

WHO CREATED IT?

↓

WHO OWNS IT?

↓

WHAT IDENTITY DOES IT USE?

↓

WHAT AUTHORITY DOES IT HOLD?

↓

WHAT CAN IT REACH?

↓

WHAT AGENTS CAN IT DELEGATE TO?

↓

WHAT DEPENDS ON IT?

↓

WHO CAN REVOKE IT?

The registry then stops being a telephone directory.

It becomes a map of operational power.

17. Inventory is a prerequisite for stop authority

The connection to the first article in this series is direct.

Who Can Stop the Agent?

Before an organisation can answer that question, it must know:

which agent;

where it is running;

which identity it uses;

which descendants it has created;

which credentials remain valid;

which external actions are already queued;

which business process depends on it.

The Stop Rogue AI Act’s proposed combination of inventory, verification, and tamper-resistant logging therefore makes architectural sense. (lawler.house.gov)

Inventory identifies the actor.

Logs preserve the activity.

Verification checks behaviour.

But stop authority adds another question:

where is the control point?

An inventory should therefore contain or reference the revocation mechanism.

An agent that appears in the registry but cannot be disabled is only partially governed.

An agent that can be disabled but has delegated active authority to invisible descendants is also only partially governed.

The ability to count and the ability to stop are connected.

18. Inventory is a prerequisite for authority provenance

The same is true of the previous article.

Authority provenance attempts to reconstruct:

principal → mandate → delegation → decision → action.

Every arrow assumes the relevant actors can be identified.

If Agent B is absent from the registry, the authority chain contains a gap.

If B and C share one identity, delegation becomes invisible.

If an ephemeral agent disappears without leaving a stable trace, the event survives while the actor becomes ambiguous.

If the human sponsor leaves but the agent remains active, the authority relationship may become orphaned.

Population inventory therefore functions as the index of authority provenance.

It tells the organisation which actors might appear in the decision record.

Without it, provenance becomes forensic archaeology.

19. Inventory is also a prerequisite for monitorability

The connection to GPT-6 Astra and the monitorability gap is equally important.

A monitoring system can observe only the actors included within its visibility boundary.

Suppose an enterprise carefully monitors Agent A.

A delegates to external Agent B.

B uses Agent C.

C invokes a tool through credentials outside the enterprise’s telemetry.

The organisation may believe it has full trajectory monitoring.

It has full monitoring of one visible portion of the trajectory.

AISI’s research into multi-agent monitoring illustrates the broader danger: distributing activity across agents can reduce the effectiveness of monitoring performed independently at the individual-agent level. (arXiv)

The first monitorability question should therefore sometimes be:

Do we know the full population whose behaviour contributes to this outcome?

Observability begins with census.

20. Population governance does not mean centralising everything

There is an obvious failure mode.

A corporation responds to agent sprawl by forbidding every local experiment and requiring one central committee to approve every ephemeral agent.

The result may be bureaucracy, slower adoption, and more shadow AI.

Gartner itself warns that simply blocking agent use is unlikely to be sustainable because employees may route around controls. (Gartner)

Good population governance should therefore distinguish visibility from centralised micromanagement.

An organisation may allow business units considerable freedom to create low-risk agents within approved blueprints.

Temporary agents can be generated automatically.

Permissions can be assigned dynamically.

Low-consequence instances may require no manual registration because registration is created automatically at runtime.

The governance requirement is not:

a human administrator manually approves every agent.

It is:

agent creation should not create invisible authority.

The safest future may involve enormous agent populations that are largely governed automatically.

The census can itself be machine-readable.

Lifecycle enforcement can be automated.

Ownership can inherit from organisational context.

Ephemeral descendants can carry lineage identifiers.

Permissions can expire automatically.

Humans enter at the points where authority or consequence becomes material.

Scale requires automation of governance, not abandonment of governance.

The Synthocracy Agent Population Test

The following is a preliminary field diagnostic for organisations deploying agentic AI. It is designed for governance review rather than as a legal conformity assessment or security certification.

1. Can the organisation enumerate its agent estate? Can it discover internally built, vendor-provided, local, cloud, embedded, delegated, and externally interacting agents rather than only those registered in one approved platform?

2. Is the counting model explicit? Does the inventory distinguish logical agent types, identities, runtime instances, ephemeral descendants, and external agents rather than presenting one unexplained headline number?

3. Does each consequential agent have a stable identity or attributable lineage? Can actions be distinguished from those of the human, service account, parent agent, or other identity through which the agent operates?

4. Does every active agent have a legitimate owner or sponsor relationship? Can the organisation identify the human or institutional role responsible for purpose, lifecycle, access review, and retirement?

5. Is registration distinguishable from authorization? Does appearing in the registry merely establish existence, or can the institution also show why the agent is entitled to operate?

6. Can the organisation identify shadow and orphaned agents? Are there agents operating outside approved registration, or agents whose sponsor, purpose, mandate, or lifecycle basis has disappeared while technical access remains?

7. Can delegated and ephemeral agents be traced? If A creates B and B delegates to C, does the inventory preserve lineage even after short-lived instances terminate?

8. Does the inventory describe power as well as presence? Can the institution identify which agents can read, write, transact, deploy, classify, communicate externally, delegate, create agents, or perform difficult-to-reverse actions?

9. Can agents be revoked at the appropriate level? Can administrators stop one instance, one identity, one class, one delegated lineage, or—where necessary—the broader agent population without relying on informal manual discovery?

10. Can the population inventory connect to evidence? When an incident occurs, can the organisation move from agent identity to sponsor, mandate, permissions, delegation chain, trajectory, logs, intervention, and consequence?

The core question is:

Could a consequential AI agent be operating inside the institution today without the institution knowing that it exists, who owns it, or what authority it holds?

If the answer is yes, the problem is no longer merely incomplete asset inventory.

It is invisible institutional power.

21. The census should become continuous

Human workforce censuses can tolerate delay.

An HR system that is several hours behind reality may usually remain useful.

Agent populations can change too quickly for periodic inventories to remain reliable.

An agent appears.

Creates three sub-agents.

One receives a token.

Another completes its task.

The parent is destroyed.

The token survives.

A new agent reuses a tool.

All of this can happen between two conventional governance scans.

That is why the language in the Stop Rogue AI Act proposal is important:

continuous, machine-readable inventory. (lawler.house.gov)

The relevant property is not merely accuracy.

It is freshness.

A registry that correctly described the agent population yesterday may be wrong today.

Future inventory systems will therefore need to behave less like static registers and more like live institutional state.

Creation changes the state.

Delegation changes the state.

Credential issuance changes the state.

Expiration changes the state.

Sponsor departure changes the state.

Revocation changes the state.

Decommissioning changes the state.

Governance becomes event-driven.

22. The agent census may become as fundamental as the employee directory

Enterprise software contains several systems so foundational that nobody treats them as optional.

The identity provider.

The employee directory.

The asset inventory.

The configuration database.

The endpoint-management system.

The application catalogue.

The agent registry may join that category.

Not because agents are employees.

But because the institution needs a durable answer to the same class of question:

Which actors are currently empowered to do things in our name?

Once agents can communicate externally, deploy software, move money, make operational classifications, modify records, access regulated information, or delegate to other systems, ignorance of their existence stops being a minor technical inconvenience.

It becomes ignorance about the distribution of institutional capacity.

23. The political dimension: who is recognised as an actor?

There is a deeper reason this subject belongs at Synthocracy Institute rather than only in a cybersecurity publication.

Institutions govern through recognition.

They decide which roles exist.

Which actors may exercise power.

Which credentials count.

Which signatures are valid.

Which decisions can bind the institution.

Which actions are attributable to whom.

Agent inventories participate in that same process.

Registering an agent does not give it political rights.

But it recognises it as an operational actor inside the institutional architecture.

This changes the conceptual map of the organisation.

The employee directory no longer describes everyone who can act.

The service-account inventory no longer describes every machine identity.

The application catalogue no longer describes every software actor.

The institution begins to contain a dynamic population of non-human executors whose membership can change at machine speed.

That population must still terminate in human law, organisational mandate, and institutional accountability.

But pretending it does not constitute a distinct governance layer will not make it disappear.

24. From asset inventory to population governance

This is the larger shift.

Asset management asks:

What systems do we possess?

Identity management asks:

Who or what is authenticated?

Access management asks:

What may they access?

Agent population governance asks a wider set of questions:

Who exists?

Who created them?

Who owns them?

Who authorised them?

What authority do they hold?

What descendants can they create?

Which population is active now?

Which actors have become orphaned?

Which agents are invisible?

How does the authority distribution change over time?

The transition can be expressed as:

ASSET INVENTORY → AGENT IDENTITY → AGENT INVENTORY → AUTHORITY MAP → POPULATION GOVERNANCE.

The first layers are primarily technical.

The final layers become institutional.

Conclusion — You cannot govern what your institution cannot see

For much of the history of enterprise AI, counting models was reasonably possible.

An organisation might have several approved AI systems.

Each had a project owner.

A procurement record.

A deployment.

A known interface.

Agentic AI changes the scale and topology of the problem.

Agents can be created by employees, vendors, platforms, applications, orchestrators, and other agents. They can be persistent or ephemeral. They can operate on behalf of humans or under autonomous workload identities. They can inherit authority, create descendants, cross vendor boundaries, and disappear while their consequences remain.

The surrounding governance infrastructure is beginning to respond. NIST is pushing toward first-class agent identities and centrally manageable authorization. Microsoft has turned agent discovery, lifecycle, sponsors, blueprints, and inventory into enterprise identity architecture. NewCore is betting a new identity company on the need to discover and govern human and agentic actors together. Gartner now explicitly recommends centralised inventories to address agent sprawl. China has standardised agent identity codes and identity management as part of its national agent-interconnection framework. And the newly introduced Stop Rogue AI Act places a continuous, machine-readable inventory of AI agents directly inside an emerging U.S. policy proposal. (NIST)

These developments come from different sectors and political systems.

They are converging on the same prerequisite.

Before an institution can decide whether an agent is aligned, authorised, monitored, stoppable, accountable, or safe, it must first be able to say:

this agent exists.

Then:

this is its identity.

this is its owner.

this is its lineage.

this is its mandate.

this is its authority.

this is its current state.

this is how we revoke it.

The future enterprise may contain more machine actors than human employees. Whether particular forecasts reach 10,000, 100,000, or 1,000,000 agents is secondary to the governance principle.

The decisive transition occurs when software actors become numerous enough, autonomous enough, and consequential enough that membership itself becomes something institutions must govern.

At that point, the agent inventory stops being an IT list.

It becomes a census of operational power.

And the central rule is simple: